As mobile communication systems evolve toward 6G, the role of the network core becomes more critical than ever. The core network is responsible for managing users, services and data flows, playing a central role in enabling advanced applications such as immersive media, autonomous systems and critical infrastructure connectivity. At the same time, this growing complexity makes the core network an increasingly attractive target for cyberattacks.
Proof of Concept 2 (PoC#2) within the MARE project focuses on how Artificial Intelligence (AI) and Machine Learning (ML) can enhance threat protection, detection and response for the 6G Core (6GC). The goal is to support a more adaptive and intelligent security framework capable of operating in highly dynamic future networks.
Why the 6G Core Needs a new Security Approach
Unlike previous generations, 6G core networks will rely heavily on software-based functions, automation and data-driven decision-making. Network components will be continuously configured and reconfigured, often without direct human intervention. While this enables efficiency and flexibility, it also reduces the effectiveness of traditional security mechanisms that rely on static rules or predefined signatures.
PoC#2 addresses this challenge by exploring how AI and ML techniques can help the network understand its own behaviour, detecting anomalies and supporting timely responses to potential threats. Instead of replacing existing security tools, AI will be used as an additional layer that enhances visibility and situational awareness.
Learning Normal Behaviour
to Detect Threats
A key concept in PoC#2 is the ability to distinguish between normal network behavior and suspicious activity. The 6G core generates large volumes of operational data related to signaling, session management and service orchestration. By analyzing this data, AI models can learn what typical behaviour looks like under normal conditions.
When deviations occur – such as unexpected signaling patterns, unusual service requests, or abnormal interactions between core functions, the system can flag these events for further analysis. This is particularly important for detecting previously unknown or evolving threats that may not match known attack signatures.
Supporting Faster and more Informed Responses
Detection alone is not enough. PoC#2 also explores how AI can assist with threat response, helping the network react more quickly and effectively. Once a potential threat is identified, AI-driven insights can support decisions such as escalating alerts, activating mitigation mechanisms, or informing operators of emerging risks.
By correlating information from multiple sources within the core network, AI can help reduce false positives and focus attention on incidents that truly matter. This improves operational efficiency while strengthening overall security.
Working Alongside Human Operators
An important aspect of PoC#2 is that AI is not treated as an autonomous authority. Instead, it is designed to support human decision-making, providing actionable insights rather than vague outcomes. In this way, network operators remain in control, using AI-generated information to better understand security events and respond appropriately.
This approach aligns with MARE’s emphasis on trustworthy and transparent use of AI, ensuring that advanced automation enhances reliability without undermining accountability.
Contributing to Secure and Trustworthy 6G Networks
PoC#2 will demonstrate how AI and ML can be integrated into the security architecture of future mobile networks in a practical and responsible way. By improving threat detection and response in the 6G core, this helps ensure that advanced services can be delivered securely and reliably.
Within the broader MARE project, PoC#2 contributes to the vision of self-aware and self-protecting networks – systems that can adapt to new threats while maintaining trust, resilience and operational stability.
As 6G development continues, AI-driven security approaches like those explored in PoC#2 will be essential to protecting the digital infrastructure that society increasingly depends on.
